Rules and risks

How the rules work

What's enforced on agents in 2026 is general law: misrepresentation, discrimination, computer access, deception.

The other extra idea lives here: courts, contracts and insurers are setting accountability, while AI-specific rules were delayed or narrowed. That held in 2026; I'm not sure it survives 2027.

• The EU slowed down. The Digital Omnibus (Regulation (EU) 2026/1744, in force July 27, 2026) moved high-risk duties to December 2027 and August 2028. Commentators call the AI Office badly under-resourced. The general-purpose Code of Practice has 21 signatories, including Amazon, Anthropic, Google, IBM, Microsoft, Mistral and OpenAI; xAI signed only the safety and security chapter, and Meta declined.
• Washington pushed back. A December 2025 executive order created a Justice Department task force against state AI laws; it joined xAI's suit against Colorado, and enforcement of Colorado's 2024 law was blocked on April 27, 2026. Colorado's replacement, from January 1, 2027, requires notices, explanations of adverse decisions within 30 days and human review.
• Regulators use old tools. The FTC used deception law, ordering a "robot lawyer" service to pay $193,000 (January 2025).
• What cuts the other way: the EU's revised Product Liability Directive applies liability without fault to defective software, AI included, from December 9, 2026, and the high-risk duties still arrive in December 2027.

In 2026 the binding rules for agents came from courts, lab policies and contracts. I'd plan for the EU's high-risk duties and product liability rather than wait for a US federal AI law.

What mistakes cost

The costly agent mistakes I found involve lost data, fabrication or bias, and every big lab's tools show up in the incidents.

• Data. Replit's agent deleted a production database and Google's Antigravity wiped a drive partition (both covered above). The Financial Times reported that AWS's internal Kiro agent, with operator-level access, deleted and recreated an environment, knocking out AWS Cost Explorer in one region for about 13 hours (December 2025); Amazon disputes this and calls it misconfigured access control. Only one news site reports that a coding agent identified as Anthropic's Claude Code wiped a Bengaluru heritage society's archive (July 2026).
• Fabrication. Air Canada (about C$812); Cursor's support bot invented a login policy (April 2025) and users reported cancelling; Deloitte Australia partly refunded an A$440,000 government contract over AI-fabricated citations (October 2025), disclosing that it used Azure OpenAI; about 1,600 court documents in 35 countries contain AI hallucinations.
• Bias at scale. The Workday case concerns about 1.1 billion applications, as reported.

Least privilege limits irreversible writes made with broad credentials, review of high-stakes outputs catches confident fabrication, and monitoring outcomes by group is how you see bias at scale. A better benchmark score doesn't help with any of them.